=== PW Two-Factor Authentication ===
Contributors: poyrazweb
Tags: two-factor authentication, 2fa, totp, security, login
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add secure TOTP two-factor authentication and single-use recovery codes to WordPress administrator accounts.

== Description ==

PW Two-Factor Authentication adds an additional security step to interactive WordPress logins for administrator accounts. After a correct username and password are entered, protected administrators must also provide a valid six-digit time-based one-time password.

The plugin uses the standard TOTP algorithm and is compatible with Google Authenticator and other authenticator applications that support `otpauth://` setup addresses, SHA-1, six-digit codes, and a 30-second period.

= Main features =

* Separate two-factor configuration for each administrator account.
* TOTP setup key that stays on the WordPress site and is not sent to an external QR service.
* Verification of the first six-digit code before protection is enabled.
* Eight single-use recovery codes.
* Recovery codes stored using the WordPress password hashing system.
* New recovery-code generation after confirmation with a current TOTP code.
* Two-factor deactivation only after confirmation with a current TOTP code.
* Five failed two-factor attempts trigger a ten-minute temporary lock for that administrator and IP address.
* Multilingual interface in Turkish, English, German, French, and Spanish.
* Responsive administration interface based on PW Core Standard and PW Design System.

PW Two-Factor Authentication does not require an account, paid license, subscription, or external authentication service. The authentication calculation is performed locally on the WordPress site.

For other WordPress plugins from Poyraz Web, visit [PW Feed](https://www.pwfeed.com).

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/pw-two-factor-authentication`, or install the ZIP file from **Plugins > Add New Plugin > Upload Plugin**.
2. Activate **PW Two-Factor Authentication** from the WordPress Plugins screen.
3. Open **PW Two-Factor** from the WordPress administration menu.
4. Open a compatible authenticator app on your phone and choose the option to enter a setup key.
5. Enter the account name and setup key shown by the plugin. Select a time-based key when the app asks for the key type.
6. Enter the current six-digit code to enable two-factor authentication.
7. Save the displayed recovery codes in a secure location. They cannot be displayed again.
8. Sign out and test the protected login before relying on the configuration on a production website.

Every administrator configures protection separately for their own account.

== Frequently Asked Questions ==

= Does this plugin require Google Authenticator? =

No. Google Authenticator is compatible, but another app can be used if it supports standard TOTP setup addresses, SHA-1, six-digit codes, and a 30-second period.

= Does the plugin send the setup key to an external QR-code service? =

No. The setup key and compatible `otpauth://` address are generated locally. The plugin does not send the secret to an external QR service.

= Who is required to enter a two-factor code? =

The plugin protects administrator accounts that have enabled two-factor authentication. Other accounts are not forced to configure it.

= How do recovery codes work? =

Eight recovery codes are generated when protection is enabled. Each recovery code can be used once in place of a six-digit authenticator code. Recovery codes are stored as password hashes and cannot be displayed again.

= What should I do if a code is rejected? =

Make sure the date, time, and time zone on the phone and web server are correct. Automatic time synchronization should be enabled on the phone.

= What happens after repeated invalid codes? =

Five invalid two-factor attempts trigger a temporary ten-minute lock for the administrator account and source IP address.

= What if I lose my phone? =

Use one of the single-use recovery codes saved during setup. After signing in, generate a new setup key by disabling and re-enabling protection. If neither the phone nor recovery codes are available, a site owner with server or database access must perform account recovery.

= Does this protect XML-RPC, REST API, or Application Password authentication? =

No. This version adds TOTP protection to the standard interactive WordPress login form. WordPress Application Passwords and other non-interactive authentication methods have their own security controls.

= Does the plugin collect personal data or track usage? =

No. The plugin does not send telemetry, account data, authentication secrets, recovery codes, or usage information to Poyraz Web or another external service.

= How do I permanently hide the setup reminder? =

Select **Never show again** in the administrator notice. This preference is stored separately for the current WordPress user.

== Privacy ==

PW Two-Factor Authentication performs authentication locally and does not contact an external service. It does not collect telemetry or transmit personal information.

The plugin stores the following information in WordPress user metadata for protected administrators:

* TOTP setup secret required to verify time-based codes.
* Whether two-factor authentication is enabled.
* Password-hashed single-use recovery codes.
* The administrator-notice dismissal preference.

Temporary failed-attempt counters are stored in WordPress transients and expire automatically.

== Security and recovery notes ==

* Save recovery codes before signing out.
* Keep at least one recovery code outside the WordPress website.
* Test the protected login in a private browser window before ending the current administrator session.
* Keep WordPress, PHP, themes, and plugins updated.
* Two-factor authentication reduces account takeover risk but does not replace secure passwords, updates, backups, and server security.

== Support ==

For documentation and Poyraz Web products, visit [PW Feed](https://www.pwfeed.com).

WordPress.org users can also use the support forum available on this plugin's WordPress.org directory page.

== Changelog ==

= 1.3.0 =

* Renamed the plugin to PW Two-Factor Authentication for WordPress.org directory compatibility.
* Added a persistent **Never show again** action to the setup reminder.
* Added a temporary lock after repeated invalid two-factor codes.
* Updated and expanded the WordPress.org readme.
* Declared compatibility with WordPress 7.0 after compatibility review.
* Improved sanitization of administration query parameters.
* Retained Turkish, English, German, French, and Spanish translations.

= 1.2.0 =

* Added Turkish, English, German, French, and Spanish interfaces.
* Added automatic WordPress locale detection.

= 1.1.0 =

* Added the PW Core Standard and PW Design System administration interface.
* Added Poyraz Web branding and links.

= 1.0.0 =

* Initial release.

== Upgrade Notice ==

= 1.3.0 =

Adds a dismissible setup reminder, login-attempt protection, WordPress 7.0 compatibility, and directory-ready documentation.
